03.04.20
Techrights Urges Readers to Ask the Linux Foundation’s Let’s Encrypt (Backed by Companies That Give the NSA Back Doors) Some Hard But Legitimate Questions
Summary: It’s not impossible that the bug in Let’s Encrypt was introduced by a rogue insider, if not someone further up above; Let’s Encrypt must address critical questions or be widely seen as a compromised, untrustworthy CA
JUST like the Linux Foundation, Let’s Encrypt is using Microsoft GitHub for their site and for their code. So much for security, eh? It’s owned by Microsoft, possibly the NSA’s closest partner. But putting that aside, today’s certificates avalanche led us to discovering that the Foundation's executive who came there from James Clapper's office has left the Foundation (she vanished from the management's page). It’s likely just a coincidence, but bringing that up isn’t crazy. We wrote about half a dozen articles already about how the Linux Foundation works for ‘surveillance capitalism’ and the ‘security state’. It’s a matter of public record and it’s easily provable using basic open source intelligence (OSINT).
At work last night, I actually had to step in for clients and urgently change certificates (to avert downtime of critical services). The fiasco is starting to show up in more of the media (but not much of it so far).
We have some facts. For instance, it is clear that somebody changed the code and we don’t know when exactly. This article explains that “Let’s Encrypt explained on Tuesday [less than a day early] it had to revoke the 3 million certificates because of a CAA bug that impacted the way its software checked domain ownership before issuing certificates.”
Here’s what they told the writer: “Josh Aas, executive director of Let’s Encrypt, said in a statement to Threatpost, “A bug was introduced in our code during a feature flag update. Under certain conditions, this bug caused us to skip a check that we are required to perform before issuing a certificate. We determined that the bug affected about 3 million, or about 2.6 percent, of our active certificates. Unfortunately, we need to revoke these certificates, which we will be doing within the compliance timeline set forth by the Baseline Requirements.””
According to this, “Let’s Encrypt will be revoking 3,048,289 currently-valid certificates” (notice how they’re contradicting themselves with the numbers).
“As part of the rules for this feature,” it adds, “authorities must check CAA records at most 8 hours before a certificate is issued.”
Also: “With only 24 hours to renew their certificates, many users are scrambling to get them done and some are running into issues.”
Yes, I should know. This caused much alarm where I work. It’s a fiasco.
We urge readers to ask Let’s Encrypt the following questions (maybe more, maybe less)
- When did you find out about this bug?
- Why was it not there before?
- Which worker is responsible for this bug?
- When was this worker hired?
- Is this worker still working for you?
- Why were the certificates all revoked so fast?
- Why was this barely announced to the public? Should the Foundation not shout from the rooftops to avert disasters (as opposed to saving face)?
- Were particular parties/stakeholders informed well in advance?
- Were government entities informed in advance (in the name of “national security”) and, if so, how long in advance?
The E-mail address to reach them on: security@letsencrypt.org
Alternative/additional E-mail: press@letsencrypt.org
Please share their answers, if any, with us.
If they fail to even respond to these questions, that will not inspire confidence, will it?
Content is available under CC-BY-SA